BCG RISE PRIVACY POLICY

 

This is the BCG RISE Privacy Policy (“Privacy Policy”) for The Boston Consulting Group, Inc. and its subsidiaries and affiliates (“BCG”, “we”, “us”, or “our”). This Privacy Policy was last updated in March 2025. For more detail on BCG’s international operations please see https://www.bcg.com/offices/default

 

Applicability of this Privacy Policy

 

This Privacy Policy applies only to your use of the RISE programs and its materials (“RISE”). This could include where access is granted to you by BCG as either a Program Partner, as part of the RISE 2.0 Program, a program designed to enhance employability by building high-demand business and digital skills, or the RISE For Business Training Program, a program designed to learn digital skills and apply them to overcome their company’s digital business challenges and drive impact in the business. For information on our other privacy practices, please see our Privacy Statement.

 

If you are accessing or using RISE in connection with services that BCG is providing to the organization with whom you are associated (“Your Organization”), BCG has executed an agreement for the provision of professional services, and that agreement and Your Organization’s privacy practices control personal data processed on behalf of Your Organization. This Privacy Statement supplements any notice that you may receive from Your Organization, and it applies only to BCG’s use of your personal data for its own purposes as described in this Privacy Statement.

 

Important information about this Privacy Policy

 

BCG understands that your privacy is important. RISE is not intended for and does not intentionally target or solicit to children or anyone of 18 years of age and younger. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

 

Changes to this Privacy Policy

 

Please note that BCG may, in its discretion, amend this Privacy Policy from time to time. To ensure you are able to remain informed, changes to this Privacy Policy will be reflected here.

 

Links to Other Sites and Services

 

RISE may contain links to external sites or services which are not governed by this Privacy Policy. We encourage you to review the privacy (and/or cookies) policies of any such sites before you submit information there.

 

Contact details:

Data Protection Office
The Boston Consulting Group Singapore Pte. Ltd.
79 Robinson Road, Level 27
Singapore 068897
Contact Us

 

The personal data we collect about you

 

Based on filling in the forms on RISE (listed below), you consent to allow BCG to collect, use, store and transfer the following personal data about you in different ways:

  • For RISE fulfilling the training administration and compliance – your first name, last name, mobile number, email, interest for specialisation, company name;
  • For registration form(s) to process your enrolment – your first name, last name, full name, email address, NRIC number, passport number or LTVP+ number (only when it’s strictly necessary to be shared based on SkillsFuture Singapore (SSG) requirements), date of birth, identity type, gender, nationality, phone number, highest educational level, your CV/Resume information where you choose to submit, years of employment, last job title, last drawn income range, employment status, employment proof documents (e.g. past employment payslips or letter of employment or letter of offer or Central Provident Fund (CPF), interest for specialisation, company information such as number of employees, annual revenue, recordings of conversations between our sales team and yourself (for training and monitoring purposes);
  • For in-course participation, your first name, last name, email address, your CV information where you choose to submit for the objective for learning, operations, compliance and employment assistance; and
  • While enrolled in the course, details that you have provided via RISE; your first name, last name, full name, email address, NRIC number, passport number or LTVP+ number (only when it’s strictly necessary to be shared based on Singapore Government Agency requirements and share with the government (BCG will not use your sensitive data for any other purposes), date of birth, identity type, gender, nationality – upon request of the SkillsFuture Singapore (SSG), phone number, highest educational level, your CV/Resume information where you choose to submit, years of employment, last job title, last drawn income range, employment status, employment proof documents (e.g. past employment payslips or letter of employment or letter of offer or CPF contribution history), interest for specialisation, start & end time of classes, assessment results; such data may be shared with SSG for the purpose of our compliance reporting to SSG.
  • Your IP addresses, partial SingPass history shared by SkillsFuture Singapore (SSG) for verifying class attendance.

 

We also collect, use and share aggregated data such as statistical data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate the data relating to details of your use of RISE to calculate the percentage of users accessing a specific RISE feature. However, if we do ever combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Policy.

 

We do not collect any special categories of personal data about you (this may include details about your religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data except your nationality and NRIC number or LTVP+ number that we need to collect only to comply with the requirement of SSG as explained above). Nor do we collect any information about criminal convictions and offences. Please note BCG does not use or disclose your sensitive personal data outside of the following purposes: (1) performing our services, (2) detecting security incidents, (3) resisting malicious, deceptive, fraudulent, or illegal actions, (4) ensuring physical safety, (5) for short-term transient use, including certain non-personalized advertising, (6) maintaining or servicing accounts, providing customer service, or providing similar services, and (7) verifying and maintaining the quality or safety of a service or product or improving, upgrading, or enhancing a service or product. Accordingly, we do not provide the right to limit the use or disclosure of your sensitive personal data.

 

How your personal data is collected

 

Information you give us. This is information you consent to giving us about you by filling in forms on RISE, or by corresponding with us (for example, by email or phone, WhatsApp groups). It includes information you or your company provide when you register to RISE or when you report a problem with RISE. If you contact us, we will keep a record of that correspondence.

 

We may also obtain information about you from Your Organization.

 

Cookies and other tracking technologies

 

When accessing or using RISE, we may utilize cookies or other tracking technologies, which may vary. A “cookie” is a small amount of data sent from a web server to your browser and stored on your computer’s hard drive. Other tracking technologies work similarly to cookies and place a small amount of data on your devices to monitor your activity to allow us to collect information about how you use RISE and our services. Cookies are also used to remember choices you make (such as your username, language, or the region you are in), recognize the device from which you access RISE, and to ensure secure, accurate session management, the IP address of your device may be recorded for the period of time that you visit RISE. These cookies may be used for combatting fraud and other security purposes. With most internet browsers, you can erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored on your computer. Please refer to your browser instructions or you can visit https://www.aboutcookies.org/ which will give you more information. Please be advised that certain sections or functionalities of RISE may be inaccessible to you if your browser does not accept cookies. We do not currently respond to browser do-not-track signals.

 

A detailed list of cookies used on rise.bcg.com is available on the cookie consent manager.

 

Purposes for which we will use your personal data

 

We process your personal data for the following purposes:

  • managing your access to RISE and access to the training content
  • monitoring usage of RISE and providing support related to accessing and using RISE and informing you about updates to RISE via email or phone call, SMS or WhatsApp;
  • confirming your registration, following up on your enrolment process, providing information on courses, masterclasses, career-related support services (e.g. outreaching for 1:1 job matching sessions, sending reminders on surveys/sign-ups for sessions/CV submissions after your registration), moderating industry group chats and sharing of job opportunities, alumni gathering information sharing via same ways;
  • tailoring your experience at RISE with relevant materials; provide trainings, run surveys for course evaluation;
  • understanding RISE’s user population, identifying subject areas of interest, and determining whether RISE is designed to work with the device settings of a majority of our visitors; and improving our RISE content and navigation; and
  • to confirm your participation at the events, workshops and/or to related courses/programmes you are registering to or registered in.

 

Insofar as you have granted us consent to the processing of personal data for specific purposes (including registration on RISE), the lawfulness of such processing is based on your consent. Otherwise, we process personal data according to our legitimate interest. When we process your personal data to provide our services or RISE to Your Organization, we process such personal data on the basis of provision of contract.

 

We may also process your personal data from your use of RISE to analyze user activity to fix errors, monitor usage, and improve the security and performance of RISE. We process such personal data according to our legitimate interest.

 

We may also process your personal data to comply with applicable laws and regulations, exercise legal actions and defense, prevent fraud, and enforce our agreements. We process such personal data as necessary to comply with a legal obligation to which we are subject.

 

Disclosures of your personal data

 

The third parties with whom we may need to share personal data are: our subsidiaries or affiliates, our advisors, our business partners, vendors, advertising partners to help us provide and operate RISE; learners (when you are part of the chat groups and or an email group to be able to receive key announcements and lesson preparations); Singapore Government Agencies who may have access to your personal data in relation to the Program completion of your learning tasks; third-parties for maintenance; our third-party service providers who process information on our behalf to provide training content, assessment and to be able to run operations (enrolments, surveys etc.); some of our internal business operations including IT services and IT infrastructure and cloud storage capabilities to enable RISE to function or any other third parties that we appoint to supersede such service providers; and law enforcement bodies in order to comply with any legal obligation or court order.

 

When using RISE on behalf of Your Organization, subject to your agreement with Your Organization, we may disclose your personal data with Your Organization.

 

BCG may be compelled to surrender personal user or customer information to legal authorities if presented with a court subpoena or similar legal or administrative order, or as required or permitted by the laws, rules and regulations of any nation, state or other applicable jurisdiction. Also, in the event of a violation of the terms and conditions of use of RISE or a violation of any restrictions on use of materials provided in or through RISE, we may disclose personal user information to authorities.

 

We may also disclose your personal data to a third party in the event of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).

 

Because BCG is a global organization, we need to transfer personal data which is collected by RISE or through other means across the BCG group of companies https://www.bcg.com/offices/default or to third parties listed above to help operate our business efficiently. These arrangements may involve your personal data being located in various countries around the world where privacy laws differ. We only make these arrangements or transfers where we are satisfied that adequate levels of protection are in place to protect personal data held in that country. In addition, RISE may be viewed and accessed anywhere in the world including countries that may not have laws regulating the use and transfer of personal data.

 

Data security

 

All information you provide to us is stored on our secure servers operated by our third-party hosting providers, and BCG has in place appropriate technological and operational security processes designed to protect personal data. Only authorized employees and contractors will have access to any data provided by you, and that access is limited by need. Each employee or contractor having access to any personal data is obligated to maintain its confidentiality. Although we take steps that are generally accepted as industry standard to protect your personal data, BCG cannot guarantee that your personal data will not become accessible to unauthorized persons and BCG cannot be responsible for any actions resulting from a breach of security when information is supplied over the internet or any public compute network. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator when we are legally required to do so.

 

Data retention

 

BCG retains your personal data for so long as is necessary to fulfil the purpose for which it was collected. Following BCG’s standard practice, BCG will delete your personal data three (3) years after the completion of training courses and/or three (3) years after the final disbursement by SSG unless otherwise required by applicable laws.

 

We may retain your personal data for longer if they may be the subject of a legal claim or may otherwise be relevant for future litigation.

 

In some circumstances we will anonymise and/or aggregate your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

 

Your rights

 

Depending on where you reside, you may have the following rights in accordance with applicable data protection laws. You have a right to request a copy of the personal data we hold about you and details of how we use that information. If any of the information held about you is incorrect or out of date, you have the right to amend or rectify it. You also have the right to require us to erase your personal data, stop processing your personal data, restricting the processing of your personal data, and right of portability of your personal data. Where the processing of your personal data is based on consent, you withdraw your consent to processing. This may not apply if there are other legal justifications to continue processing. You may also have the right to lodge a complaint with a relevant supervisory authority, state attorney general, or other applicable authority, and the right not to receive discriminatory treatment for exercising your data protection rights. You may also have the right to opt-out of: (1) the “sale” or “sharing” of your personal data; (2) targeted advertising; or (3) automated decision-making or profiling in furtherance of decisions that produce legal or similarly significant effects, although please note BCG does not engage in such activities in connection with RISE.

 

If you are accessing or using RISE in connection with services that BCG is providing Your Organization, we are typically a data processor with respect to the personal data provided by Your Organization. In order to exercise your data protection rights with respect to such personal data, please contact Your Organization directly.

 

If you (or an authorized agent acting on your behalf) would like to exercise any of your data protection rights where we are acting as your data controller, or you believe your request was denied by BCG and would like to appeal, please contact us via datasubjectrights@bcg.com. Please note that we need you to prove who you are (including obtaining additional information from you) before we can act on your request.